Splunk Enterprise improper neutralization vulnerabilities allow low-privileged remote compromise (CVE-2026-76302)

What happened

CVE-2026-76302 groups multiple vulnerabilities found during Cisco's internal security review of Splunk Enterprise and addressed in the October 2026 software hardening release. They are grouped under CWE-707, improper neutralization.

According to the CVSS vector, the weaknesses are reachable over the network with low attack complexity and require only low privileges; no user interaction is needed. Successful exploitation could cause high impact to confidentiality, integrity and availability, and the scope change means other resources could also be affected.

Neither the CVE record nor Splunk's advisory states that these vulnerabilities have been publicly disclosed or exploited.

Who is affected

Affected versions are Splunk Enterprise 10.4 to before 10.4.4, 10.2 to before 10.2.8, 10.0 to before 10.0.11 and 9.4 to before 9.4.16. If your instance is on one of those ranges, treat it as vulnerable.

The CVSS vector assumes network reach and low privileges; Splunk's advisory does not note deployment-specific prerequisites beyond that.

What to do now

1. For Splunk Enterprise 10.4 to before 10.4.4, upgrade to Splunk Enterprise 10.4.4.
2. For Splunk Enterprise 10.2 to before 10.2.8, upgrade to Splunk Enterprise 10.2.8.
3. For Splunk Enterprise 10.0 to before 10.0.11, upgrade to Splunk Enterprise 10.0.11.
4. For Splunk Enterprise 9.4 to before 9.4.16, upgrade to Splunk Enterprise 9.4.16.
5. No workaround is listed in Splunk's advisory. Until you upgrade, restrict network access to Splunk Enterprise and review use of low-privileged accounts.

How to detect it

Splunk's advisory does not provide specific indicators of compromise. Because these weaknesses are network-reachable and require only low privileges, review Splunk Enterprise authentication and activity logs for unexpected actions by low-privileged accounts, especially on instances reachable from untrusted networks.

Beyond the patch

When a vendor discovers vulnerabilities internally and ships them as a hardening release, the patch may not get the attention of a public exploit. That makes accurate software inventory and vendor fix-cycle tracking the practical control. Our Supply Chain Defense & Third-Party Risk service helps you know which Splunk Enterprise versions are running and how quickly you close the gap. If you need to align this with broader programme timelines, book a meeting.